CVE-2003-1044: Mozilla Bugzilla

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.

Affected products

• Mozilla Bugzilla: version 2.4 only; version 2.6 only; version 2.8 only; version 2.10 only; version 2.12 only; version 2.14 only; …

Published 2004-08-18. Last modified 2026-06-16.